Configure a Globus Auth client to prompt for which Globus ID to authenticate

[Steven Lee]

Hi,

I have seen some Globus Auth clients that prompt the user with linked identities to select which identity to use. How is that accomplished? Thanks in advance for any pointers.

Steven Lee

Cornell University Center for Advanced Computing

721 Rhodes Hall, Ithaca NY 14853

Email: sh...@cornell.edu

[Karl Kornel]

Hi Steven,

There are a few ways of doing that.

If you have a confidential client, and you want your client to only ever be usable from a specific identity provider, pull up the Globus App’s details, and look for the setting “Required Identity”.

If you want your client to apply this restriction dynamically, you can use a Policy.  This has two steps:

1. Pull up your Globus App’s Project, go to the Policies tab, and click “Add a Policy”.  Specify which domains are allowed.  At the end, you’ll get a Policy UUID.

2. When you construct the authorization URL for logging in the user, append `session_required_policies=YOUR_POLICY_UUID` to the URL.

For more details on this method, see https://docs.globus.org/api/auth/developer-guide/#authentication-policies

Good luck!

~ Karl

From: 'Steven Lee' via Discuss <dis...@globus.org>
Date: Friday, July 17, 2026 at 7:51 AM
To: Discuss <dis...@globus.org>
Subject: [Globus Discuss] Configure a Globus Auth client to prompt for which Globus ID to authenticate

To unsubscribe from this group and stop receiving emails from it, send an email to discuss+u...@globus.org.